Upper bounds for the secure key rate of decoy state quantum key distribution 
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The use of decoy states in quantum key distribution (QKD) has provided a method for sub- 
stantially increasing the secret key rate and distance that can be covered by QKD protocols with 
practical signals. The security analysis of these schemes, however, leaves open the possibility that 
the development of better proof techniques, or better classical post-processing methods, might fur- 
ther improve their performance in realistic scenarios. In this paper, we derive upper bounds on 
the secure key rate for decoy state QKD. These bounds are based basically only on the classical 
correlations established by the legitimate users during the quantum communication phase of the 
protocol. The only assumption about the possible post-processing methods is that double click 
events are randomly assigned to single click events. Further we consider only secure key rates based 
on the uncalibrated device scenario which assigns imperfections such as detection inefficiency to the 
eavesdropper. Our analysis relies on two preconditions for secure two-way and one-way QKD: The 
legitimate users need to prove that there exists no separable state (in the case of two-way QKD), or 
that there exists no quantum state having a symmetric extension (one-way QKD), that is compati- 
ble with the available measurements results. Both criteria have been previously applied to evaluate 
single-photon implementations of QKD. Here we use them to investigate a realistic source of weak 
coherent pulses. The resulting upper bounds can be formulated as a convex optimization problem 
known as a semidefinite program which can be efficiently solved. For the standard four-state QKD 
protocol, they are quite close to known lower bounds, thus showing that there are clear limits to 
the further improvement of classical post-processing techniques in decoy state QKD. 

PACS numbers: 



I. INTRODUCTION 

Quantum key distribution (QKD) [H,0 allows two par- 
ties (Alice and Bob) to generate a secret key despite 
the computational and technological power of an eaves- 
dropper (Eve), who interferes with the signals. Together 
with the Vernam cipher Q , QKD can be used to provide 
information-theoretic secure communications. 

Practical QKD systems can differ in many important 
aspects from their original theoretical proposal, since 
these proposals typically demand technologies that are 
beyond our present experimental capability. Especially, 
the signals emitted by the source, instead of being single 
photons, are usually weak coherent pulses (WCP) with 
typical average photon numbers of 0.1 or higher. The 
quantum channel introduces errors and considerable at- 
tenuation (about 0.2 dB/km) that affect the signals even 
when Eve is not present. Besides, for telecom wave- 
lengths, standard InGaAs single-photon detectors can 
have a detection efficiency below 15% and are noisy due 
to dark counts. All these modifications jeopardize the 
security of the protocols, and lead to limitations of rate 
and distance that can be covered by these techniques [J] . 

A main security threat of practical QKD schemes based 
on WCP arises from the fact that some signals contain 



more than one photon prepared in the same polarization 
state. Now Eve is no longer limited by the no-cloning 
theorem Q since in these events the signal itself provides 
her with perfect copies of the signal photon. She can per- 
form, for instance, the so-called photon number splitting 
(PNS) attack on the multi-photon pulses Q. This at- 
tack gives Eve full information about the part of the key 
generated with the multi-photon signals, without causing 
any disturbance in the signal polarization. As a result, it 
turns out that the standard BB84 protocol [f| with WCP 
can deliver a key generation rate of order 0(r] 2 ), where r] 
denotes the transmission efficiency of the quantum chan- 
nel 0,3- 

To achieve higher secure key rates over longer dis- 
tances, different QKD schemes, that are robust against 
the PNS attack have been proposed in recent years 

[l(| EL EH EH • One of these schemes is the so-called 
decoy state QKD [1 ES E3 where Alice 

varies, indepen- 
dently and at random, the mean photon number of each 
signal state that she sends to Bob by employing differ- 
ent intensity settings. Eve does not know a priori the 
mean photon number of each signal state sent by Alice. 
This means that her eavesdropping strategy can only de- 
pend on the photon number of these signals, but not on 
the particular intensity setting used to generate them. 
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From the measurement results corresponding to differ- 
ent intensity settings, the legitimate users can estimate 
the classical joint probability distribution describing their 
outcomes for each photon number state. This provides 
them with a better estimation of the behaviour of the 
quantum channel, and it translates into an enhancement 
of the achievable secret key rate and distance. This tech- 
nique has been successfully implemented in several recent 
experiments [ l4f . and it can give a key generation rate of 
order 0(rj) 0, Eft EH- 

While the security analysis of decoy state QKD in- 
cluded in Refs. [§, HO, HH * s relevant from a practical 
point of view, it also leaves open the possibility that the 
development of better proof techniques, or better clas- 
sical post-processing protocols, might further improve 
the performance of these schemes in realistic scenarios. 
For instance, it is known that two-way classical post- 
processing protocols can tolerate a higher error rate than 
one-way communication techniques (lil . Il6j |. or that by 
modifying the public announcements of the standard 
BB84 protocol it is possible to g enerate a secret key even 
from multi-photon signals [12|]. Also, the use of local 
randomization [l7| and degenerate codes can as well 
improve the error rate thresholds of the protocols. 

In this paper we consider the uncalibrated device sce- 
nario [3] and we assume the typical initial post-processing 
step where double click events are not discarded by Bob, 
but they are randomly assigned to single click events 
fl9j |. In this scenario, we derive simple upper bounds 
on the secret key rate and distance that can be covered 
by decoy state QKD based exclusively on the classical 
correlations established by the legitimate users during 
the quantum communication phase of the protocol. Our 
analysis relies on two preconditions for secure two-way 
and one-way QKD. In particular, Alice and Bob need 
to prove that there exists no separable state (in the 
case of two-way QKD) [2(], [Hj], or that there exists no 
quantum state having a symmetric extension (one-way 
QKD) [22}, that is compatible with the available mea- 
surements results. Both criteria have been already ap- 
plied to evaluate single-photon implementations of QKD 
[H EH, [H, H, HI- Here we employ them for the first 
time to investigate practical realizations of QKD based 
on the distribution of WCP. 

We show that both preconditions for secure two-way 
and one-way QKD can be formulated as a convex op- 
timization problem known as a semidcfinite program 
(SDP) [25| | . Such instances of convex optimization prob- 
lems appear frequently in quantum information theory 
and can be solved with arbitrary accuracy in pol yno mial 
time, for example, by the interior-point methods [25|. As 
a result, we obtain ultimate upper bounds on the perfor- 
mance of decoy state QKD when this typical initial post- 
processing of the double clicks is performed. These up- 
per bounds hold for any possible classical communication 
technique that the legitimate users can employ in this sce- 
nario afterwards like, for example, the SARG04 protocol 
fl2| , adding noise protocols [ijj , degenerate codes proto- 



cols 1181 and two-way classical post-processing protocols 
[HI, Il6| |. The analysis presented in this manuscript can 
as well be straightforwardly adapted to evaluate other 
implementations of the BB84 protocol with practical sig- 
nals as, for instance, those experimental demonstrations 
based on WCP without decoy states or on entangled sig- 
nals coming from a parametric down conversion source. 

The paper is organized as follows. In Sec. |TT] we de- 
scribe in detail a WCP implementation of the BB84 pro- 
tocol based on decoy states. Next, in Sec. HIT] we apply 
two criteria for secure two-way and one-way QKD to this 
scenario. Here we derive upper bounds on the secret key 
rate and distance that can be achieved with decoy state 
QKD as a function of the observed quantum bit error rate 
(QBER) and the losses in the quantum channel. More- 
over, we show how to cast both upper bounds as SDPs. 
These results are then illustrated in Sec. IIVI for the case 
of a typical behaviour of the quantum channel, i.e., in 
the absence of eavesdropping. Finally, Sec. [V] concludes 
the paper with a summary. 

II. DECOY STATE QKD 

In decoy state QKD with WCP Alice prepares phase- 
randomized coherent states with Poissonian photon num- 
ber distribution. The mean photon number (intensity) of 
this distribution is chosen at random for each signal from 
a set of possible values \i\ . In the case of the BB84 proto- 
col, and assuming Alice chooses a decoy intensity setting 
I, such states can be described as 

00 n 

^(w) = e"' l! ^^K) B (n fe | ! (1) 

n=Q 

where the signals \rik) B denote Fock states with n pho- 
tons in one of the four possible polarization states of 
the BB84 scheme, which arc labeled with the index 
k e {0, . . . , 3}. On the receiving side, we consider that 
Bob employs an active basis choice measurement setup. 
This device splits the incoming light by means of a polar- 
izing beam-splitter and then sends it to threshold detec- 
tors that cannot resolve the number of photons by which 
they are triggered. The polarizing beam-splitter can be 
oriented along any of the two possible polarization basis 
used in the BB84 protocol. This detection setup is char- 
acterized by one positive operator value measure (POVM) 
that we shall denote as {Bj}. 

In an entanglement-based view, the signal preparation 
process described above can be modeled as follows: Alice 
produces first bipartite states of the form 

3 00 

^source) AB =Y1Y1"^P 1 ^A 1 \ 1 )a 2 \M A3B , (2) 
fe=0 1=0 

where system A is the composition of systems A\, A 2 , 
and A3, and the orthogonal states \k) Ai and \l) A record, 
respectively, the polarization state and decoy intensity 
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setting selected by Alice. The parameters qk and pi rep- 
resent the a priori probabilities of these signals. For in- 
stance, in the standard BB84 scheme the four possible 
polarization states are chosen with equal a priori prob- 
abilities and qk = 1/4 for all k. The signal \4>ki) a 3 b 
that appears in Eq. (|2|) denotes a purification of the state 
Pb (/■*/) and can be written as 

oo n 

\MA 3B = ^' /2 Y,^rr\ n )A> k ) B , (3) 

n=0 

where system A3 acts as a shield, in the sense of Ref. [26| 
and records the photon number information of the sig- 
nals prepared by the source. This system is typically 
inaccessible to all the parties. One could also select as 
\4>ki) a 3 b an y other purification of the state p B (pi). How- 
ever, as we will show in Sec. the one given by Eq. ([3]) 
is particularly suited for the calculations that we present 
in that section. 

Afterwards, Alice measures systems A\ and A2 in 
the orthogonal basis \k) Ai and \l) A , corresponding to 
the measurement operators Aki = \k) Ai (k\ <E> \l) A 
This action generates the signal states p B (pi) with a 
priori probabilities qkPi- The reduced density matrix 
p A = Ti-b(pab), with p AB = |* S ourcc) j4B (*sourcc|, is 
fixed by the actual preparation scheme and cannot be 
modified by Eve. In order to include this information in 
the measurement process, one can add to the observables 
{Aki®Bj}, measured by Alice and Bob, other observables 
{Ci g) 1b} such that {Ci} form a complete tomographic 
set of Alice's Hilbcrt space Ha [HI- I n or( ier to simplify 
our notation, from now on we shall consider that the ob- 
served data pkij = Tr(Aki ® Bj pab) and the POVM 
{Aki ® Bj} contain also the observables {Ci CS> 1b}. That 
is, every time we refer to {Aki®Bj} we assume that these 
operators include as well the observables {Ci <g> Is}. 

III. UPPER BOUNDS ON DECOY STATE QKD 

Our starting point is the observed joint probability 
distribution pkij obtained by Alice and Bob after their 
measurements {Aki ® Bj}. This probability distribution 
defines an equivalence class S of quantum states that are 
compatible with it, 

S = {a A B I Tr(A H ® Bj <7 A b) = Pkij Vfc, I, j}. (4) 

A. Two-way classical post- processing 

Let us begin by considering two-way classical post- 
processing of the data pkij. It was shown in Ref. [2l[ 
that a necessary precondition to distill a secret key in 
this scenario is that the equivalence class S does not 
contain any separable state. That is, we need to find 
quantum- mechanical correlations in Pkij, otherwise the 
secret key rate, that we shall denote as K, vanishes [2^ |. 



As it is, this precondition answers only partially the im- 
portant question of how much secret key Alice and Bob 
can obtain from their correlated data. It just tells if the 
secret key rate is zero or it may be positive. However, 
this criterion can be used as a benchmark to evaluate any 
upper bound on K . If S contains a separable state then 
the upper bound must vanish. One upper bound which 
satisfies this condition is that given by the regularized 
relative entropy of entanglement [28|. Unfortunately, to 
calculate this quantity for a given quantum state is, in 
general, a quite difficult task, and analytical expressions 
are only available for some particular cases [2{|. Besides, 
this upper bound depends exclusively on the quantum 
states shared by Alice and Bob and, therefore, it does 
not include the effect of imperfect devices like, for in- 
stance, the low detection efficiency or the noise in the 
form of dark counts introduced by current detectors [23| . 
Another possible approach is that based on the best sepa- 
rable approximation (BSA) of a quantum state aAB (301 ] - 
This is the decomposition of (Jab into a separable state 
a sep and an entangled state p en t, while maximizing the 
weight of the separable part. That is, any quantum state 
(Jab can always be written as 

a AB = K a AB)&sep + [1 - K a AB)]Pent, (5) 

where the real parameter \(ctab) _ is maximal. 

Given an equivalence class S of quantum states, one 
can define the maximum weight of separability within 
the class, \ BSA , as 

^bsa = max{X(a A B) | <?ab € S}. (6) 

Note that the correlations pkij can originate from a sep- 
arable state if and only if \ BS a = 1- Let S B n g A denote 
the equivalence class of quantum states given by 

s bsa = {Pent | oab € S and \{ctab) = A BSA }, (7) 

where p en t represents again the entangled part in the 
BSA of the state gab- Then, it was proven in Ref. [23[ 
that the secret key rate K always satisfies 

K<(l-X BSA )P nt (A;B), (8) 

where I ent (A;B) represents the Shannon mutual infor- 
mation calculated on the joint probability distribution 
q k i 3 = Tr(^4 fei <g> Bj p ent ). As it is, this upper bound 
can be applied to any QKD scheme [23[, although the 
calculation of the parameters \% SA and p en t might be a 
challenge. Next, we consider the particular case of decoy 
state QKD. 

Upper bound on two-way decoy state QKD 

The signal states p%(ni) that Alice sends to Bob are 
mixtures of Fock states with different Poissonian pho- 
ton number distributions of mean pi. This means, in 
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particular, that Eve can always perform a quantum non- 
demolition (QND) measurement of the total number of 
photons contained in each of these signals without in- 
troducing any errors. The justification for this is that 
the total photon number information via the QND mea- 
surement "comes free" , since the execution of this mea- 
surement does not change the signals p B (fXi)- That is, 
the realization of this measurement cannot make Eve's 
eavesdropping capabilities weaker [3lj . If Eve performs 
such a QND measurement, then the signals p AB = 
|* S ourcc) J 4 B (*sourcc| are transformed as 

CO 

Pab i-* Iab = ^2r n \<p n ) AiB {ip n \®\p n ) A2 {p n \®\n) A3 {n\, 

n=0 

(9) 

where the probabilities r„ are given by 

n! 

z=o 

the signals \ip n ) AlB have the form 

3 

\Vu) AxB =^2V<lk\ k )A 1 \ n k)B> ( n ) 

and the normalized states \p n ) A ^ only depend on the sig- 
nals \1)a 2 aim the photon number n. 

From the tensor product structure of jab we learn 
that the signals jab can only contain quantum corre- 
lations between systems A\ and B. Therefore, without 
loss of generality, we can always restrict ourselves to only 
search for quantum correlations between these two sys- 
tems. Additionally, in decoy state QKD Alice and Bob 
have always access to the conditional joint probability 
distribution describing their outcomes given that Alice 
emitted an n-photon state. This means that the search 
for quantum correlations in S can be done independently 
for each n-photon signal. That is, the legitimate users 
can define an equivalence class of signal states for each 
possible Fock state sent by Alice. 

A further simplification arises when one considers the 
typical initial post-processing step where double click 
events are not discarded by Bob, but they are randomly 
assigned to single click events |19fl . In the case of the 
BB84 protocol, this action allows Alice and Bob to al- 
ways explain their observed data as coming from a single- 
photon signal where Bob performs a single-photon mea- 
surement {Tj} [32j| . This measurement is characterized 
by a set of POVM operators which are projectors onto 
the eigenvectors of the two Pauli operators a x and a z , 
together with a projection onto the vacuum state \vac) 
which models the losses in the quantum channel, 

To = \\0) B (0\, 2i = ±|l> B (l|, 

T± = -|±) B (±|, T vac =\vac) B (vac\, (12) 



with |±) = (|0) ± |l))A/2 and where £\ Tj = t B [13]. 
In particular, let pjj- denote the conditional joint proba- 
bility distribution obtained by Alice and Bob after their 
measurements {A^®Tj}, with Ak = \k) Ai (k\, given that 
Alice emitted an n-photon state. That is, pjy includes the 
random assignment of double clicks to single click events. 
As before, we consider that the observables {Ak <S> Tj} 
contain as well other observables {C, CS> 1b} that form a 
tomographic complete set of Alice's Hilbcrt space H Al ■ 
We define the equivalence class S n of quantum states 
that are compatible with pjy as 

S n = WXb I Tr(^l fe ® Tj a\ B ) = p%, Vfc, j}. (13) 
Then, the secret key rate K can be upper bounded as 

K< $>„(l-Af^)£ nt (4iJ), (14) 

where A BSyl denotes the maximum weight of separabil- 
ity within the equivalence class S n , and I^ nt (A; B) rep- 
resents the Shannon mutual information calculated on 
qfy = Tr(Ak ® Tj p"„ t ), with p" nt being the entangled 
part in the BSA of a state <J A B £ S n and whose weight 
of separability is maximum. 

The main difficulty when evaluating the upper bound 
given by Eq. (|14[) still relies on obtaining the parameters 
X BSA and Pent- Next, we show how to solve this problem 
by means of a semidefinite program (SDP) (2f| . For that, 
we need to prove first the following observation. 

Observation: Within the equivalence classes S n of 
quantum signals given by Eq. (fl~3"]) Alice and Bob can 
only detect the presence of negative partial transposed 
(NPT) entangled states HI). 

Proof. The signals o~\ iB £ S n can always be decom- 
posed as 

°Xb =PPa 1 b + (I-P)pli ® \vac) B (vac\, (15) 

for some probability p £ [0, 1], and where p AB £ H Al ® 
H2, and p A £ H Al . That is, the state <r\ lB can only 
be entangled if p\ lB is also entangled. In order to detect 
entanglement in the latter one, Bob projects it onto the 
eigenvectors of the two Pauli operators <j x and a z . This 
means, in particular, that the class of accessible entangle- 
ment witness operators W that can be constructed from 
the available measurements results satisfy W = W r . 
Here T denotes transposition with respect to Bob's sys- 
tem. We have, therefore, that Th:{Wp\ B ) = Tr(WT2), 
with fl = \[p AlB + Pa\b\- For the given dimensionali- 
ties, it was proven in Ref. [34| that whenever Q is non- 
negative it represents a separable state, i.e., Ti(WQ) > 0. 
This means that Alice and Bob can only detect entan- 
gled states p AB that satisfy fi ^ 0. Since p AlB > 0, the 
previous condition is only possible when p\J B ^ 0. I 

Let us now write the search of X BSA and p™„ t as a SDP. 
This is a convex optimisation problem of the following 
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form teal: 



minimize c x 



(16) 



subject to F(x) = F + V] a:^ > 0, 



where the vector x represents the objective variable, the 
vector c is fixed by the particular optimisation problem, 
and the matrices -Fo and are Hcrmitian matrices. The 
goal is to minimize the linear function c T x subjected to 
the linear matrix inequality (LMI) constraint F(x) > 0. 
The SDP that we need to solve has the form 1351] : 



A G AB B . \Oab & >0/ 

• • o A& = o AB 




Oab B 

-• 



FIG. 1: Graphical illustration of a quantum state oab which 
has a symmetric extension to two copies of system B. 



minimize 1 — Tr[cr™ (x)] (17) 
subject to cr AlB (x) > 0, 

Tr[a n AlB (x)} = 1, 

Tr[Ak ® Tj a n AlB {*))=pt j , Wk,j, 
< p (x) > 0, 

< p r (x) > 0, 

o-AxbW - C p (x) > 0, 

where the objective variable x is used to parametrise the 
density operators cr™ ep and ( t"^ . For that, we employ the 
method introduced in Refs. |23Tl24l]. The state <7™ ep which 
appears in Eq. (| 1 7[) is not normalized, i.e., it also includes 
the parameter \{o~ AlB ). The first three constraints in 
Eq. (fTT)) guarantee that cr AlB is a valid normalized den- 
sity operator that belongs to the equivalence class S n , the 
following two constraints impose cr™ ep to be a separable 
state, while the last one implies that the entangled part 
of cr AB is a valid but not normalized density operator. 
Its normalization factor is given by 1 — X(cr A B ). If x so ; 
denotes a solution to the SDP given by Eq. (jT7|) then 



^ S bsa = Tr[<r" (x soi )], 



and the state p™ nt is given by 



CT^ lB (x so/ ) - <T% ep (x sol ) 



^BSA 



(18) 



(19) 



B. One-way classical post- processing 

The classical post-processing of the observed data can 
be restricted to one-way communication [3(| . Depending 
on the allowed direction of communication, two differ- 
ent cases can be considered: Direct reconciliation (DR) 
refers to communication from Alice to Bob, reverse rec- 
onciliati on ( RR) permits only communication from Bob 
to Alice |37|. In this section, we will only consider the 
case of DR. Expressions for the opposite scenario, i.e., 
RR, can be obtained in a similar way. In Ref. [13] it was 
shown that a necessary precondition for secure QKD by 
means of DR (RR) is that the equivalence class S given 
by Eq. ((4|) does not contain any state having a symmetric 
extension to two copies of system B (system A). 



A state gab is said to have a symmetric extension to 
two copies of system B if and only if there exists a tri- 
partite state a abb' > 0, with Tt(oabb') = 1, and where 
Hb — Ti-B', which fulfills the following two properties 
M: 



Tr B / (a abb') 

POABB'P 



0~AB, 
0~ABB' 



(20) 
(21) 



where the swap operator P satisfies P\ijk) ABB , = 
\ikj) abb' ■ A graphical illustration of a state cr AB which 
has a symmetric extension to two copies of system B is 
given in Fig. [TJ This definition can be easily extended 
to cover also the case of symmetric extensions of a ab to 
two copies of system A, and also of extensions of gab to 
more than two copies of system A or of system B. 

The best extendible approximation (BEA) of a given 
state (Jab is the decomposition of o~ab into a state with a 
symmetric extension, that we denote as o~ ex t , and a state 
without symmetric extension p ne , while maximizing the 
weight of the extendible part, i.e., 



GAB = Ho-AB)o- e xt + [1 - Ho~AB)]Pr, 



(22) 



where the real parameter A(ctab) > is maximal [23. l39j| . 
Note that this parameter is well defined since the set of 
extendible states is compact. 

Equation follows the same spirit like the BSA 
given by Eq. Now, one can define analogous parame- 
ters and equivalence classes as in Scc. lIII Al In particular, 
the maximum weight of extendibility within an equiva- 
lence class 5 is defined as = max{A(avLB) | <jab £ 
S}. That is, the correlations pkij = Tr(j4jy (g> Bj gab) 
can originate from an extendible state if and only if 
X BEA — 1. Finally, one defines S BEA as the equivalence 
class of quantum states given by S BEA = {p ne \ o ab € 
S and X(ctab) = X BEA }, where p ne denotes the nonex- 
tcndible part in the BEA of the state a AB . Then, it was 
proven in Ref. [13] that the one-way secret key rate i^_> 
satisfies 



< (1 



A BEA) 1 



\A;B), 



(23) 



where I ne (A; B) represents the Shannon mutual informa- 
tion now calculated on the joint probability distribution 
qkij = Tr(A kl ® B d p ne ) with p ne £ S% e EA . 
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Upper bound on one-way decoy state QKD 



The analysis contained in Sec. IIII Al to derive Eq. (jT4j) 
from Eq. ([5]) also applies to this scenario and we omit it 
here for simplicity. We obtain 



E 

TI>1 



r n {l-\f EA )IT{A;B) 



(24) 



where A^^ denotes the maximum weight of extcndibil- 
ity within the equivalence class S n given by Eq. (fl~3|) . 
and I™ e (A;B) represents the Shannon mutual informa- 
tion calculated on q^- = Tr(A k ®Tj p% e ), with p" e being 
the nonextendible part in the BE A of a state o\ lB £ S' a 
and whose weight of cxtendibility is maximum. 

The parameter \%ea anc ^ the nonextendible state p^ e 
can directly be obtained by solving the following SDP: 

minimize 1 — Tr[(r2 I . t (x)] (25) 
subject to tr^ iB (x) > 0, 

TrK lB (x)] = 1, 

Tr[A k ®T j a AlB (x)]=Pk j , Vfc,j, 
PMBB'W >0, 
Pp% BB .{*)P = P% BB ,{*1 

r ftB'[p n AlBB <(x)]=^ xt (x), 

crl lB (x) - cr" xt (x) > 0, 

where the state a™ xt is not normalized, i.e., it also in- 
cludes the parameter X(a AiB ). The first three constraints 
coincide with those of Eq. (jTTJ). They just guarantee 
that <J AlB € S n . The following three constraints im- 
pose a" xt to have a symmetric extension to two copies 
of system B, while the last one implies that the nonex- 
tendible part of cr AlB is a valid but not normalized den- 
sity operator. Its normalization factor is 1 — A(er^ B ). 
This SDP does not include the constraint cr™ xt > be- 
cause non- negativity of the extension p AlBB i, together 
with the condition ^B'ip^BB 1 ) = a ext' already implies 
non-negativity of a" xt . If x so ; represents a solution to the 
SDP given by Eq. ((23)) then we have that 



^BEA = ^[^exti^sol)], 

and the state p™ e is given by 

Pne ~ , ^S n 

1 BE A 



(26) 



(27) 
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TABLE I: Conditional joint probability distribution p^j = 
Tr(A k ® Tj <J n AlB ), where the index h G {0, . . . , 3} la- 
bels, respectively, the four possible polarization states of the 
BB84 protocol (0, 1, + , — ), and the operators Tj are given by 
Eq. It satisfies J2 k 3 Pkj = 1 - 



A. Channel model 

To generate the observed data, we consider the chan- 
nel model used in Rcf . [13, IHJ . This model reproduces 
a normal behaviour of the quantum channel, i.e., in the 
absence of eavesdropping. Note, however, that our anal- 
ysis can as well be straightforwardly applied to other 
quantum channels, as it only depends on the probability 
distribution that characterizes the results of Alice's 
and Bob's measurements. This probability distribution 
is given in Tab. [H where the conditional yields Y n have 
the form 



Y„ 



Y + [i - (i - v ) n ] 



(28) 



with Yq being the background detection event rate of 
the system, and where rj represents the overall transmit- 
tancc, including the transmission efficiency of the quan- 
tum channel and the detection efficiency. The parameter 
e n denotes the quantum bit error rate of an n-photon 
signal. It is given by 



e det [l-(l-r)) n ] + hY ( 



2 



Y n 



(29) 



where edet represents the probability that a photon hits 
the wrong detector due to the misalignment in the quan- 
tum channel and in the detection apparatus. 

The parameter rj can be related with a transmission 
distance I measured in km for the given QKD scheme as 
r\ = 10 — iff, where a represents the loss coefficient of the 
optical fiber measured in dB/km. The total dB loss of 
the channel is given by al. 



IV. EVALUATION 

In this section we evaluate the upper bounds on the se- 
cret key rate both for two-way and one-way decoy state 
QKD given by Eq. fH} and Eq. (j2~4"|) . Moreover, we com- 
pare our results with known lower bounds for the same 
scenarios. The numerical simulations are performed with 
the freely available SDP solver SDPT3-3.02 together 
with the parser YALMIP [ilj . 



B. Illustration of the upper bounds 

As discussed in Sec. IIII1 the reduced density matrix 
of Alice, that we shall denote as p A , is fixed and can- 
not be modified by Eve. This state has the form p\ = 

TT B (\tp n ) AiB (tp n \) = Efc, fc '=o y/lkqk' {n k > \n k )\k) Al (k'\, 
where \f n )A 1 B ^ s gi ven by Eq. (JTTJ) . In the standard 
BB84 protocol the probabilities q k satisfy q k = 1/4. We 
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obtain, therefore, that p\ can be expressed as 



( 



1 



2 -n/2 





1 

2 -n/2 

(-1)™2~"/ 2 



2 -n/2 

2-n/a 

1 





2-n/a 
(-1)™2 

1 



» /2 



/ 

(30) 

To include this information in the measurement process, 
we consider that Alice and Bob have also access to the 
results of a set of observables {Cj® Is} that form a tomo- 
graphic complete set of Alice's Hilbert space "Hax ■ In par- 
ticular, we use a Hermitian operator basis {C\, . . . , Ciq}. 
These Hermitian operators satisfy Tr(Cj) = 4<5,i and 
have a Hilbert-Schmidt scalar product Tr(C,;Cj) = iSij. 
The probabilities Tr(C 4 ® 1 B <r\ lB ) = Tr{d p\), with 
p\ given by Eq. gJJJ. 

The resulting upper bounds on the two-way and one- 
way secret key rate are illustrated, respectively, in Fig. [2] 
and Fig. [3] They state that no secret key can be distilled 
from the correlations established by the legitimate users 
above the curves, i.e., the secret key rate in that region 
is zero. These figures include as well lower bounds for 
the secret key rate obtained in Rcfs. [1, [lj| [Hj]. Note, 
however, the security proofs included in Refs. [1, 
implicitly assume that Alice and Bob can make public 
announcements using two-way communication, and only 
the error correction and privacy amplification steps of 
the protocol are assumed to be realized by means of one- 
way communication. We consider the uncalibrated de- 
vice scenario and we study two different situations in each 
case: (1) no errors in the quantum channel, i.e., Yq = 0, 
e det = 0, and (2) Y = 1.7 x 10~ 6 and e det = 0.033. This 
last scenario corresponds to the experimental parameters 
reported by Gobby- Yuan-Shields (GYS) in Ref. H|. Fig- 
ure [2] and Fig. [3] do not include the sifting factor of 1/2 
for the BB84 protocol, since this effect can be avoided 
by an asymmetric basis choice for Alice and Bob [44| . 
Moreover, we consider that in the asymptotic limit of a 
large number of transmitted signals most of them repre- 
sent signal states of mean photon number ^o- That is, 
the proportion of decoy states used to test the behaviour 
of the quantum channel within the total number of sig- 
nals sent by Alice is neglected. This means that po in 
Eq. (TTUj) satisfies po m 1 and 



(31) 



C. Discussion 

In the case of no errors in the quantum channel (Case 
(1) above) the lower bounds for two-way and one-way 
QKD derived in Refs. @, M, Gl 

coincide. Furthermore, 
for low values of the total dB loss, the upper bounds 
shown in the figures present a small bump which is spe- 
cially visible in this last case. The origin of this bump is 



■ UB (Case 1) 

■ LB (Case 1) 

■ UB (Case 2) 

■ LB (Case 2) 



10 



20 30 40 50 
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FIG. 2: Upper bounds on the two-way secret key rate K given 
by Eq. (|14p in logarithmic scale in comparison to known lower 
bounds for the same scenario given in Ref. [lf|. The figure 
includes two cases. (1) No errors in the quantum channel, i.e., 
Yo = and edet = 0. In this case, the upper bound (UB) is 
represented by a thin solid line, while the lower bound (LB) 
is represented by a thin dashed line. (2) Yo = 1.7 x 1CP 6 
and edet = 0.033,which correspond to the GYS experiment 
reported in Ref. [43|]. In this case, the upper bound (UB) is 
represented by a thick solid line, while the lower bound (LB) 
after 3 B steps is represented by a thick dashed line. We 
assume asymmetric basis choice to suppress the sifting effect 

H. 



the potential contribution of the multi-photon pulses to 
the key rate. 

Let us now consider the cutoff points for decoy state 
QKD in the case of errors in the quantum channel (Case 
(2) above). These are the values of the total dB loss for 
which the secret key rate drops down to zero in Fig. [5] 
and Fig. [3] We find that they are given, respectively, 
by: m 51.1 dB (lower bound two-way after 3 B steps), 
sa 57.4 dB (upper bound two-way), f» 44.9 dB (lower 
bound one-way), and « 53.5 dB (upper bound one-way 
with RR). These quantities can be related with the fol- 
lowing transmission distances: 179.2 km, 209.2 km, 149.6 
km and 190.6 km. Here we have used a = 0.21 dB/km 
and the efficiency of Bob's detectors is 4.5% (43[. It is in- 
teresting to compare the two-way cutoff point of 209.2 km 
with a similar distance upper bound of 208 km provided 
in Ref. [l6[ for the same values of the experimental pa- 
rameters. Note, however, that the upper bound derived 
in Ref. (l6j relies on the assumption that a secure key 
can only be extracted from single photon states. That 
is, it implicitly assumes the standard BB84 protocol. If 
this assumption is removed and one also includes in the 
analysis the potential contribution of the multi-photon 
signals to the key rate (due, for instance, to the SARG04 
protocol [l2j ) , then the cutoff point provided in Ref. 
transforms from 208 km to 222 km, which is above the 
209.2 km presented here. 
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FIG. 3: Upper bounds on the one-way secret key rate 
given by Eq. (|24p in logarithmic scale in comparison to known 
lower bounds for the same scenario given in Refs. [1, fiol ]. 
The figure includes two cases. (1) No errors in the quantum 
channel, i.e., Yo ~ and e^t = 0. In this case, the upper 
bound (UB) RR is represented by a thin solid line, while the 
lower bound (LB) is represented by a thin dashed line. (2) 
Yo — 1.7 x 10 -6 and e^et = 0.033, which correspond to the 
GYS experiment reported in Ref. [43| . In this case, the upper 
bound (UB) RR is represented by a thick solid line, while the 
lower bound (LB) is represented by a thick dashed line. The 
two lines on the left hand side of the graphic represent upper 
bounds for the case of DR (case (1) short dashed line, case (2) 
dash-dotted line). The inset figure shows an enlarged view of 
the upper bounds for a total dB loss ranging from to 5 dB. 
We assume asymmetric basis choice to suppress the sifting 
effect 0. 



Figure [3] shows a significant difference between the 
behaviour of the upper bounds for one-way classical 
post-processing with RR and DR. Most importantly, the 
upper bounds on K_> for the case of DR can be be- 
low the lower bounds on the secret key rate derived in 
Refs. Note, however, that the scenario considered 

here is slightly different from the one assumed in the se- 
curity proofs of Refs. [1, [HI. In particular, the analysis 
contained in Sec. lIIIBl for the case of DR does not allow 
any communication from Bob to Alice once the condi- 
tional probabilities pjj. are determined. This means, for 
instance, that Bob cannot even declare in which partic- 
ular events his detection apparatus produced a "click". 
However, as mentioned previously, Refs. implicitly 
assume that only the error correction and privacy ampli- 
fication steps of the protocol are performed with one-way 
communication. If the analysis performed in Sec. IIII Bl 
is modified such that Bob is now allowed to inform Alice 
which signal states he actually detected, then it turns out 
that the resulting upper bounds in this modified scenario 
coincide with those derived for the case of RR. To include 
this initial communication step from Bob to Alice in the 
analysis, one can use the following procedure. Let the 



projector Ha x b be defined as 

IL AlB = t Al ® (t B - \vac) B (vac\). (32) 
Then, one can add to Eq. (f25|) one extra constraint 

A\B W = v ' t 33 ' 

1 n 

and substitute the condition o^ibM — a ea;t( x ) ^ by 
<7^(x)-^ 4 (x)>0. (34) 

Equation (|33|) refers to the normalized state that is posts- 
elected by Alice and Bob once Bob declares which signals 
he detected. Equation (|3"4"|) indicates that the BEA has to 
be applied to this postselected state. Finally, each term 
in the summation given by Eq. (|24[) has to be multiplied 
by the yield Y n , i.e., the probability that Bob obtains 
a "click" conditioned on the fact that Alice sent an n- 
photon state. 

Our numerical results indicate that the upper bounds 
given by Eq. (|T4j) and Eq. (|24|) are close to the known 
lower bounds available in the scientific literature for the 
same scenarios. However, one might expect that these 
upper bounds can be further tightened in different ways. 
For instance, by substituting in Eq. (fT4]) and Eq. (|24[) the 
Shannon mutual information with any other tighter up- 
per bound on the secret key rate that can be extracted 
from a classical tripartite probability distribution mea- 
sured on a purification of the state p™ nt (in the case of 
two-way QKD) or of the state p™ e (one-way QKD). More- 
over, as they are, Eq. (fbl|) and Eq. (|24j) implicitly assume 
that the legitimate users know precisely the number of 
photons contained in each signal emitted. However, in 
decoy state QKD Alice and Bob have only access to the 
conditional joint probability distribution describing their 
outcomes given that Alice emitted an n-photon state, but 
they do not have single shot photon number resolution 
of each signal state sent. 

As a side remark, we would like to emphasize that to 
calculate the upper bounds given by Eq. (fbl")) and Eq. (|2~4"1) 
it is typically sufficient to consider only a finite number 
of terms in the summations. This result arises from the 
limit imposed by the unambiguous state discrimination 
(USD) attack [31(. This attack does not introduce any 
errors in Alice's and Bob's signal states. Moreover, it cor- 
responds to an entanglement-breaking channel [4a ] and, 
therefore, it cannot lead to a secure key both for the case 
of two-way and one-way QKD [20l . [22j . The maximum 
probability of unambiguously discriminating an n-photon 
state sent by Alice is given by [3l[ 

!0 n < 2 

1 - 2 1 -"/ 2 n even (35) 
1 - 2( 1 -")/ 2 n odd. 

For typical observations this quantity can be related with 
a transmission efficiency r\ n of the quantum channel, i.e., 
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an r/ n that provides an expected click rate at Bob's side 
equal to Pg. This last condition can be written as 

ry„ = l-(l-PS) 1/n - (36) 

Whenever the overall transmission probability of each 
photon satisfies r\ < rj n , then any pulse containing n or 
more photons is insecure against the USD attack. After 
a short calculation, we obtain that the total number of 
n-photon signals that need to be considered in the sum- 
mations of Eq. (fl"4|) and Eq. (|24|) can be upper bounded 
as 

n < f L io g2[ i (1 -,)] J n even (37) 
" I L 2l0g2[ ^(i-,)] J n odd - 

V. CONCLUSION 

In this paper we have derived upper bounds on the 
secret key rate and distance that can be covered by two- 
way and one-way decoy state quantum key distribution 
(QKD). Our analysis considers the uncalibrated device 
scenario and we have assumed the typical initial post- 
processing step where double click events are randomly 
assigned to single click events. We have used two pre- 
conditions for secure two-way and one-way QKD. In par- 
ticular, the legitimate users need to prove that there ex- 
ists no separable state (in the case of two-way QKD), or 
that there exists no quantum state having a symmetric 
extension (one-way QKD), that is compatible with the 
available measurements results. Both criteria have been 
previously employed in the scientific literature to evalu- 
ate single-photon implementations of QKD. Here we have 
applied them to investigate a realistic source of weak co- 
herent pulses, and we have shown that they can be for- 



mulated as a convex optimization problem known as a 
semidefinite program (SDP). Such instances of convex 
optimization problems can be solved efficiently, for ex- 
ample by means of the interior-point methods. 

As a result, we have obtained fundamental limitations 
on the performance of decoy state QKD when this initial 
post-processing of the double clicks is performed. These 
upper bounds cannot be overcome by any classical com- 
munication technique (including, for example, SARG04 
protocol, adding noise protocols, degenerate codes and 
two-way classical post-processing protocols) that the le- 
gitimate users may employ to process their correlated 
data afterwards. Moreover, our results seem to be al- 
ready close to well known lower bounds for the same sce- 
narios, thus showing that there are clear limits to the fur- 
ther improvement of classical post-processing techniques 
in decoy state QKD. 

The analysis presented in this paper could as well be 
straightforwardly adapted to evaluate other implemen- 
tations of the BB84 protocol with practical signals like, 
for example, those experimental demonstrations based 
on WCP without decoy states or on entangled signals 
coming from a parametric down conversion source. 
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